Malicious
JavaScript
MD5: d1fccfe6fce8208ad271f3ef4dbb55d2
Size: 4.25 MB
application/javascript
Ctrl + scroll to zoom · drag to pan
This sample is a 4 MB JavaScript classified as malicious by Malva.RE. Static analysis extracted 3 embedded or derived files. It matches 3 YARA rules. Observed behaviours map to MITRE ATT&CK T1027, T1059.001 and T1059.007. The file was analysed statically: it was parsed and decompiled, never executed.
- SHA256
- 411e3f2572813e3410f2ebbc7c396b077c5fa706f1a1bb3e15127e7acbd7e8e0
- MD5
- d1fccfe6fce8208ad271f3ef4dbb55d2
- Verdict
- Malicious
- File type
- JavaScript · 4 MB
Cite this report: https://app.malva.re/sha256/411e3f2572813e3410f2ebbc7c396b077c5fa706f1a1bb3e15127e7acbd7e8e0
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
JavaScript file
Size
4.25 MB · 4,245,334 B
First seen
2026-10-30 07:31 · 3 days ago
Last seen
2026-10-30 07:31 · 3 days ago
Last analysis
2026-10-30 07:31 · 3 days ago
Hashes
MD5
d1fccfe6fce8208ad271f3ef4dbb55d2
Sha1
f1b28c517ec2cb93649a316cd0e9b3b7d2a12abc
Sha256
411e3f2572813e3410f2ebbc7c396b077c5fa706f1a1bb3e15127e7acbd7e8e0
Sha384
9ecd97d5b2b4944f7d9340be464c50e75e00bebe2b1b61df5393acca261ed1e97868e5b9d605492c993bf55c1de57ae9
Sha512
06adf4ff17628f133f80e5ab204bc5083c5801ce9d792fcd8a769c7510d75bd37fd4d7937f76ba7d531012f890b3094aba0a1e11043112a899d8e4d586351b42
SSDeep
98304:LABYYGt1iIxkKh+YXQ2lA1sdB6mNZmH7HZ3x6zI11iihxNDFfX174zTKvHcguYwn:mhAlQz1sdB6ymH75B681hhxRhlYvkln8
TLSH
A2166B3C5544E3F260B8F61DC91B7DCA1BE97F571DE0AA7435BC7AA9A288F063328150
4 malicious · 4 files
JSd1fccfe6fce8208ad271f3ef4dbb55d2T1027 · T1059.001 · T1059.007
BINd1fccfe6fce8208ad271f3ef4dbb55d2.emulated
SH[Command #1]T1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
scr:js~T1059.007>scr:bat>scr:ps1~T1027~T1059.001
Shape
scr:js>scr:bat>scr:ps1
malicious
3 nodes
Command (emulation JS) #1
UNKNWOWNmalicious
cmd /chuhuhuhuhuhuhuhuhuhuhu
Command (emulation JS) #2
UNKNWOWNmalicious
\VZWMIhuhuhuhuhuhuhuhuhuhuhu
Trace d'emulation JS (ordonnee)
UNKNWOWNmalicious
#? nehuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
ehuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential